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Sir: 

This Appeal is being filed in response to the decision by the Examiner 
in the Final Office Action dated February 7, 2006 in which claims 23-44 were 
finally rejected. In accordance with 37 CFR §41 .37, the Appellant provides 
the following. 



I. 



REAL PARTY IN INTEREST 



The Real Party in Interest in this Appeal is Hitachi, Ltd., as evidenced 
by the Assignment filed on February 26, 2002 in Application Serial No. 
10/046,224, filed January 16, 2002, said application being the subject of this 
Appeal, and recorded on Reel 012624 and Frame 0156. 
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II. RELATED APPEALS AND INTERFERENCE 

There are no other Appeals or Interferences that may directly affect, 
may be directly affected by, or have a bearing on the Board's decision in this 
appeal. 

III. STATUS OF CLAIMS 

Claims 23-44 are currently pending. 

Claims 25-27, 29, 31-34, 37-39 and 42-44 are rejected under 35 USC 
§112, second paragraph as being indefinite for failing to particularly point out 
and distinctly claim the subject matter which Applicants regard as their 
invention; 

Claims 23-44 are rejected under 35 U.S.C. §101 as being directed to 
non-statutory subject matter; and 

Claims 23-44 are rejected under 35 U.S.C. §1 03(a) as being 
unpatentable over U. S. Patent No. 6,697,488 to Cramer et al. ("Cramer"). 

IV. STATUS OF AMENDMENTS 

An Amendment was filed September 7, 2006 so as to amend claims 
23-44 to correct the informalities noted by the Examiner, and to bring the 
claims into conformity with the requirements of 35 U.S.C. §112, second 
paragraph and 35 U.S.C. §101. In an Advisory Action mailed on September 
21 , 2006, the Examiner denied entry of this Amendment. Another 
Amendment was filed on even date herewith so as to include the 
amendments of the September 7, 2006 Amendment, to further amend claim 
24 to overcome the 35 U.S.C. §101 rejection, and to correct a minor 
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informality in claim 36. Entry of this Amendment is requested as it simplifies 
the issues for appeal. The Appendix being submitted with the present Appeal 
incorporates the amendments to claims 23-44, which were filed on even date 
herewith. No other amendments were filed after final rejection. 

V. SUMMARY OF THE CLAIMED SUBJECT MATTER 

The present invention as recited in the claims is directed to a public- 
key cryptographic method implemented in a computer, and a cryptographic 
communication method implemented in a computer, such as that illustrated, 
for example, in Figs. 4-6. The public-key cryptographic method implemented 
in a computer system generates a secret key and a public key by a key 
generation step, performs a ciphertext generation and transmission step of 
selecting random numbers for a plaintext, performs a ciphertext reception and 
decipher step of calculating from the received ciphertext by using the secret 
key which satisfies a particular function, outputs the deciphered results if the 
function is satisfied, and outputs an indication that the received ciphertext is 
rejected if the function is not satisfied. 

Specifically, as recited in independent claim 23, the present invention 
as described, for example, on page 9, line 15 to page 13, line 4 of the present 
application, is directed to a public-key cryptographic method implemented in a 
computer system. The method includes a key generation step of generating a 
secret-key: 

• xux 2 ,yiu 2/12, 2/21, 2/22, * € Z q 
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and a public-key: 

• G, G f : finite (multiplicative) group G Q G f 

• q : prime number (the order of G) 

• 9u 92 € G 

• c = Si* l S2 X3 , di - 9x Vlx 92 Vl2 , d 2 = (?i Wl P2 V33 , A = 

• 7T : Ii x X 2 x M — ► C : one-to-one mapping 

• 7T" 1 : Im(7r) — > X 1 x X 2 x M 

The group G is a partial group of the group G', and Xi and X 2 are an infinite 
set of positive integers which satisfy: 

<*i||c*2 < q (Vai € X u Va 2 € X 2 ) 

M is a plaintext space. The method also includes a ciphertext generation and 
transmission step of selecting random numbers ciieXi, a 2 eX 2 , reZq for a 
plaintext m (m e M), and calculating: 

ui = 9 i r , u 2 = 92 r , e = 7r(a u a 2 ,m)h r , v = 0i Ol c r di ap cfe mr 

where a = ch || a 2 . The ciphertext generation and transmission step also 
includes transmitting (ui, u 2 , e, v) as a ciphertext. The method also includes a 
ciphertext reception and decipher step of calculating from the received 
ciphertext and by using the secret key, a'i, a' 2 , m' (a'ieXi, a l 2 eX 2 , m'eM) which 
satisfy: 

*r(a'i, c^m') = e/ui z 

If the following is satisfied: 
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then m' is output as the deciphered results (where a' = aS || a' 2 ). If not 
satisfied, then the effect that the received ciphertext is rejected is output as 
the decipher results. 

Further, as recited in independent claim 24, the present invention as 
described, for example, on page 13, line 6 to page 15, line 18 of the present 
application, is directed to a public-key cryptographic method implemented in a 
computer system. The method includes a key generation step of generating a 
secret-key: 

• xi,x2,yii,yi2,sm,y22>z £ %q 

and a public-key: 

• P> Q : prime number (q is a prime factor of p- 1 ) 

• 9i,92 e Z p : ordpfci) = ovd p (g 2 ) = Q 

• c = 9i Xl 92 X2 mod p, di = g\ Vll g2 Vl2 mod p, d 2 = 9i V2l 9 2 V27 mod p, h = g\ z mod p, 

• fci,fc2,A:3 = positive constant (lO fcl+A53 < q, 10* 3 < q, I0 fcl+fc3+fc 3 < p) 

The method also includes a ciphertext generation and transmission step of 
selecting random numbers a = ch || a 2 (|ai| = ki, |a 2 | = k 2 ) for a plaintext m (|m| 
= k 3 where |x| is the number of digits of x), and calculating: 

m = a\\K 

The ciphertext generation and transmission step also includes selecting a 
random number reZq, calculating: 

u\ = gi r mod p, U2 = 92 mod p, e = m h r mod p, v = gi ai c r d\ ar d2 rnr mod p 

and transmitting (ui, u 2 , e, v) as a ciphertext. The method also includes a 
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ciphertext reception and decipher step of calculating from the received 
ciphertext and by using the secret key, a'i, a' 2 , m' (|a'i| = ki, |a' 2 | = te, |m'| = 
k 3 ) which satisfy: 

a ill a 2ll m ' = modp 

If the following is satisfied: 

then m* is output as the deciphered results (where a' = a'i || a' 2 ). If not 
satisfied, then the effect that the received ciphertext is rejected is output as 
the decipher results. 

Furthermore, as recited in independent claim 28, the present invention 
as described, for example, on page 15, line 20 to page 19, line 6 of the 
present application, is directed to a cryptographic communication method 
implemented in a computer system. The method includes a key generation 
step of generating a secret-key: 

• ^i, #2,2/11, 2/12, 2/21,2/22,2 ^ Z q 

and a public-key: 

• G y G' : finite (multiplicative) group G C CP 

• q : prime number (the order of G) 
•01,02 € G 

• c = 0i Xl 0 2 12 , d x = 0i^<72 Vl2 , d 2 = 9i V21 92 y22 > h = 9l z t 

• 7r : X\ x X<z x M — y G' : one-to-one mapping 

• 7T- 1 : Im(7r) — > X x x X 2 x M 

• £7 : symmetric encipher function 
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where the group G is a partial group of the group G', and Xi and X 2 are an 
infinite set of positive integers which satisfy: 

ail|a 2 < q (Vai € X u Va 2 € X 2 ) 

M is a key space. The method also includes a ciphertext generation and 
transmission step of selecting random numbers cneX^ a 2 eX 2 , reZq for key 
data K (K e M), calculating: 

ui = <?i r , u 2 = p 2 r , e = 7r(ai,a 2 ,i^)/i r , v = gi ai c r di ar d 2 Kr 
where a = ai || a 2 , generating a ciphertext C of transmission data m by: 

C = E K (m) 

by using a symmetric cryptographic function E and key data K, and 
transmitting (ui, u 2 , e, v, C) as the ciphertext. The method also includes a 
ciphertext reception and decipher step of calculating from the received 
ciphertext and by using the secret key, a'i, a' 2 , K' (aSeX^ a' 2 eX 2 , K'eM) which 
satisfy: 

If the following is satisfied (where a' = a'i || a 2 ): 
a decipher process is executed by: 

m = £>K'(C) 
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The deciphered results are output. If not satisfied, the effect that the received 
ciphertext is rejected are output as the decipher results. 

Yet even further, as recited in independent claim 30, the present 
invention as described, for example, on page 19, line 6 to page 22, line 14 of 
the present application, is directed to a cryptographic communication method 
implemented in a computer system. The method includes a key generation 
step of generating a secret-key: 

• ai,X2, 2/11, 2/12, 2/21, 2/22, Z € Z q 

and a public-key: 

• P, Q : prime number (q is a prime factor of p- 1 ) 

• 9\y92 € Z P : ordp(pi) = ord p (#2) = q 

m c — g\ Xl g2 X2 mod p, d\ = gx Vll g2 Vl2 mod p, d<i = gi V2l g2 V22 mod p, h = g\ z mod p, 

• fci,^, : positive constant (lO* 1 ** 2 < q y 10* 3 < q y I0 fcl + fc2+fc3 < p) 

• E : symmetric encipher function 

The method also includes a ciphertext generation and transmission step of 
selecting random numbers a = ch || a 2 (foi | = ki, |a 2 | = k 2 ) for key data K (|K| = 
k 3 where |x| is the number of digits of x), calculating: 

m =a||/C 

The ciphertext generation and transmission step also includes selecting a 
random number reZq, calculating: 

u\ = g\ T mod p, ui — g*i mod p, e = m h r mod p, v — gi ai c r di ar d2 Kr mod p 

and generating a ciphertext C of transmission data by: 
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C = E K (m) 

by using a (symmetric) cryptographic function E and the key data K, and 
transmitting (m, u 2 , e, v, C) as the ciphertext. The method also includes a 
ciphertext reception and decipher step of calculating from the received 
ciphertext and by using the secret key, aS, a' 2 , K' (|a'i| = k 1f |a' 2 | = k 2 , |K'| = k3) 
which satisfy: 

ailla'allJC' = e/m* modp 
If the following is satisfied (where a' = a'i || a' 2 ): 

^l a iui Xl+a/yil+/c ' Wl u 2 X2+a/yi2+/r ' y " = v (mod p) 

a decipher process is executed by: 

m = D K ,(C) 

The deciphered results are output. If not satisfied, the effect that the received 
ciphertext is rejected is output as the decipher results. 

Still further, as recited in independent claim 35, the present invention 
as described, for example, on page 22, Iine16 to page 25, Iine18 of the 
present application, is directed to a cryptographic communication method 
implemented in a computer system. The method includes a key generation 
step of generating a secret-key: 

and a public-key: 
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• G,G f : finite (multiplicative) group G C. G' 

• q : prime number (the order of G) 

• 0i, 92 € G 

•c = gx Xl 92 x \ d = 91^92^. h = si*, 

• n : Xi x X 2 x M — > Dom(JE) : one-to-one mapping 

(Dom(E) is the domain of the function E) 

• 7T" 1 : Im(7r) — ► Xi x X 2 x M 

• i/ : hash function 

• i? : symmetric encipher function 

where the group G is a partial group of the group G', and X^ and X 2 are an 
infinite set of positive integers which satisfy: 

c*i||a2 < Q (Vai € X Xi Va 2 6 X 2 ) 

The method also includes a ciphertext generation and transmission step of 
selecting random numbers GheXi, a 2 eX 2 , r e Zq, calculating: 

ui = 9l r , u 2 = 0 2 r , v - 9i ai c r <f* r , K = (fc r ) 
where a = ai || 02, generating a ciphertext C of transmission data m by 

C = E K (ir(ai } a 2 ,m)) 

by using a (symmetric) cryptographic function E, and transmitting (ui, u 2 , v, C) 
as the ciphertext. The method also includes a ciphertext reception and 
decipher step of calculating: 

K' = Him*) 

by using the secret key, calculating from the received ciphertext, a'i, a' 2 
(where a'ieXi a' 2 eX 2 ) which satisfy: 
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7r(ai,a' 2 ,m') = D K ,(C) 

If the following is satisfied (where a' = a'i || a' 2 ): 

then m' is output as the deciphered results. If not satisfied, the effect that the 
received ciphertext is rejected is output as the decipher results. 

Furthermore, as recited in independent claim 36, the present invention 
as described, for example, on page 25, line 20 to page 28, line 9 of the 
present application, is directed to a cryptographic communication method in a 
computer system. The method includes a key generation step of generating a 
secret-key: 

and a public-key: 

• Pj Q prime number (q is a prime factor of p-1) 

• 91,92 € Zp : ordp(0i) = ord p (^ 2 ) = Q 

• c = pi Xl <72 X2 mod p, d = gi Vl g2 V2 mod p, h = g\ z mod p, 

• *i, k 2y k 3 : positive constant (lO k i+ k * < g, 10* 3 < g, I0 fcl + fc2 +* 3 < p) 

• H : hash function 

• E : symmetric encipher function (the domain of E is all positive integers) 

The method also includes a ciphertext generation and transmission step of 
selecting random numbers a = ai || a 2 (|o 1 1 = ki, |a 2 | = k 2 , where (|x| is the 
number of digits of x), selecting a random number reZq, calculating: 

u\ = gx r mod p, u 2 = g*i mod p, v = gx ai c r d ar mod p, K = H(h r mod p) 
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and transmitting the ciphertext (ui, u 2 , v, C). the ciphertext generation and 
transmission step also includes generating a ciphertext C of transmission data 
m by: 

C = E K (a x \\<x 2 \\m) 

by using a (symmetric) cryptographic function, and transmitting (ui, u 2 , v, C) 
as the ciphertext. The method further includes a ciphertext reception and 
decipher step of calculating: 

K 1 = H (u x z mod p) 

by using the secret key, and calculating from the received ciphertext, a'i, a' 2 
(|a'i| = ki, |a' 2 | = k 2 ) which satisfy: 

a'MWm' = D K ,(C) 

If the following is satisfied: 

g l a iui Xl + a ' yi u 2 X3 + Q ' y2 s v (mod p) 

then m' is output as the deciphered results (where a' = a'i || a' 2 ). If not 
satisfied, the effect that the received ciphertext is rejected is output as the 
decipher results. 

Yet even further, as recited in independent claim 40, the present 
invention as described, for example, on page 28, line 1 1 to page 31 , line 5 of 
the present application, is directed to a cryptographic communication method 
implemented in a computer system. The method includes a key generation 
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step of generating a secret-key: 

• sk : (asymmetric cryptography) decipher key 

and a public-key: 

• G : finite (multiplicative) group 

• q : prime number (the order of G) 

• 9i,92 € G 

• 7T : X\ x X 2 x M — > Dom(E) : ?" e " t0 /° n ? TPg in 8 . f t , f f . ~ 

(Dom(E) is the domain of the function E) 

• Tr- 1 : Im(7r) — ► X x x X 2 x M 

• ^pJt(') (asymmetric cryptography) encipher function 

where the group G is a partial group of the group G\ and X 1 and X 2 are an 
infinite set of positive integers which satisfy: 

<*ill<*2 < Q (Vai £ Xi, Vc*2 6 X2) 

where M is a plaintext space. The method also includes a ciphertext 
generation and transmission step of selecting random numbers cheXi, a 2e X 2 , 
reZq, calculating: 

u! = 9l r , u 2 = 9 2 r , v = 9l a *c r d ar 
where a = ai || a 2 , generating a ciphertext C of transmission data m by: 

e = E pk {'n(oti,at2,m)) 

by using an (asymmetric) cryptographic function E pk , and transmitting (ui, u 2 , 
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e, v) as the ciphertext. The method also includes a ciphertext reception and 
decipher step of calculating from the received ciphertext and by using the 
secret key, a'i, a' 2 , m 1 (a'i e Xi, a'2eX 2 , m' e M) which satisfy: 

7r(ai, a' 2i m') = D sk (e) 

If the following is satisfied: 

0i a iui* l+a ' Vl U2 Xa+a ' V2 = v 

where: 

a' = ai||a^ 

then m' is output as the deciphered results. If not satisfied, the effect that the 
received ciphertext is rejected is output as the decipher results. 

Still even further, as recited in independent claim 41 , the present 
invention as described, for example, on page 31 , line 7 to page 33, line 23 of 
the present application, is directed to a cryptographic communication method 
implemented in a computer system. The method includes a key generation 
step of generating a secret-key: 

• sk : (asymmetric cryptography) 
decipher key 

and a public-key: 

• P» Q : prime number (q is a prime factor of p-1) 

• 9\>92 e Zp : ordp(0i) = ord p (^ 2 ) = q 

• c = gi Xl g2 X2 mod p, d = gi Vl Q2 y2 mod p, 

• &ii *2 • positive constant (lO fcl+ * 3 < q) 

• ^pfc(*) : (asymmetric cryptography) encipher function 

(the domain is all positive integers) 
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The method also includes a ciphertext generation and transmission step of 
selecting random numbers a = Ch || a 2 (|oi | = k 1f |a 2 | = k 2l where |x| is the 
number of digits of x), selecting a random number reZq, calculating: 

ui = gi r mod p, u<i = 9<i mod p, v = (/i ai c r (P r mod p 

The ciphertext generation and transmission step also includes generating a 
ciphertext C of transmission data m (positive integer) by: 

e = E pk (ai\\a2\\m) 

by using the secret key, and transmitting (ui, u 2 , e, v) as the ciphertext. The 
method also includes a ciphertext reception and decipher step of calculating 
from the received ciphertext and by using the secret key, a'i, a' 2 , m' (|a'i| = ki, 
|a' 2 | = kz, m 1 is a positive integer) which satisfy: 

aill«2l|m' - D. k {e) 
If the following is satisfied: 

gi<u 1 x ^ a ' vl u 2 X2 ^ y2 = v (mod p), 

where: 

«' = <*' x \\a' 2 

then m' is output as the deciphered results. If not satisfied, then the effect that 
the received ciphertext is rejected is output as the decipher results. 
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VI. GROUNDS OF REJECTION TO BE REVIEWED ON APPEAL 

Whether claims 25-27, 29, 31-34, 37-39 and 42-44 are indefinite under 
35 USC §112, second paragraph; 

Whether claims 23-44 are directed to statutory subject matter as 
required by 35 USC §101; and 

Whether claims 23-44 are obvious over Cramer under 35 USC 
§1 03(a). 

VII. ARGUMENT 

A. 35 USC §112, second paragraph rejection of claim 25-27, 29, 
31-34, 37-39 and 42-44 

Each of claims 25-27, 29, 31-34, 37-39 and 42-44 are definite and fully 
comply with the requirements of 35 USC §112, second paragraph. Therefore, 
reconsideration and withdrawal of the 35 USC §112, second paragraph 
rejection of claims 25-27, 29, 31-34, 37-39 and 42-44 are respectfully 
requested. 

B. 35 USC §101 rejection of claims 23-44 

Each of claims 23-44 is directed to a practical application, namely the 
encrypting and decrypting of communications in a computer system which 
implements a public-key or communication cryptographic method. Thus, the 
claims are directed to a "process" implemented by a "machine" as permitted 
under 35 USC §101. Therefore, reconsideration and withdrawal of this 
rejection is respectfully requested. 



16 



C. 35 USC §1 03(a) rejection of claims 23-44 

The above described features of the present invention as clearly 
recited in claims 23-44 are not taught or suggested by any of the references 
of record, particularly Cramer, whether taken individually or in combination 
with any of the other references of record. 

Cramer teaches a scheme that improves the security of encrypted 
data or information by using a practical public cryptosystem that is able 
to resist adaptive attacks. According to Cramer, the scheme does not 
leak any information of the secret of the used key by generating an 
extended private key and public key. As per Cramer, a message m, also 
referred to as plaintext, can be encrypted to obtain a cipher text t by 
using the public key. This cipher text t can be transmitted over an 
insecure channel such as the Internet so that only a recipient with the 
right private key is able to decrypt the cipher text t. 

The proof of security according to the system taught by Cramer is 
based on standard assumptions which are the hardness of the Diffie- 
Hellman decision problem (DDH problem), wherein the DDH problem is 
very hard to solve due to the large calculation volume; and the collision 
intractability of the hash function, which is equivalent to the existence of 
universal one-way functions. 

Cramer employs a hash function in the encryption algorithm as 
described in col. 7, line 50 to col. 8, line 21 and col. 1 1 , line 60 to col. 1 2, 
line 34 thereof. Cramer also discloses a particular encryption method using 
a hash function and the hash value in claims 1 1 and 12 thereof. 
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The proof of security of the present invention as described, for 
example, on page 4, line 26 through page 7, line 4 of the present 
application relates to a security system which is also based on an 
assumption of the hardness of the Diffie-Heilman decision problem. 
However, the proof security of the present invention, as recited in 
independent claims 23, 24, 28, 30, 40, and 41, is not based on the above 
described assumption regarding the collision intractability of the hash 
function through which the existence of the universal one-way functions are 
provided. In the present invention, as recited in independent claims 23, 24, 
28, 30, 40, and 41 , a hash function and a hash value are not used in the 
encryption process. 

As is well known, various cryptographic schemes are based on 
various assumptions. However, such assumptions are not always realistic. 
The collision intractability of the hash function has not yet been verified 
(see page 3, line 27 to page 4, line 24 of the present application). 
Therefore, contrary to Cramer, the present invention, as recited in 
independent claims 23, 24, 28, 30, 40, and 41 , does not rely on the 
unverified assumption of the collision intractability of the hash function for 
encryption and as such is directed to an encryption process entirely 
different from Cramer. 

Thus, as is quite clear from the above, the present invention, as 
recited in independent claims 23, 24, 28, 30, 40, and 41 , is quite different 
from Cramer, particularly with regard to the assumptions based upon. 
According to the present invention, as recited in independent claims 23, 24, 
28, 30, 40, and 41, hash functions and values are not used in the 
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encryption process thereof. Therefore, the features of the present 
invention as recited in the claims are not taught or suggested by Cramer 
whether taken individually or in combination with any of the other 
references of record. 

Further, Cramer does not assume the random oracle model but 
assumes a universal one way hash function contrary to that of the present 
invention. The universal one way hash function is an algorithm which can 
prove the security. However, it is an ideal function and it is actually 
replaced with a practical hash function such as SHA-1. This replacement 
makes the proof of the security insecure. This is an inherent problem of 
Cramer. Attention is directed to the article entitled "Random Oracle", which 
was filed in an Information Disclosure Statement on even date herewith. 
This phenomenon is well-known as discussed on page 5, lines 19 and 21 
of the present application and as discussed column 5, lines 44 to 47 of 
Cramer. Cramer refers to this phenomenon as "collision resistant hash 
functions." 

The present invention, as recited in independent claims 23, 24, 28, 
30, 40, and 41 , does not assume the universal one way hash function and 
provides an encryption scheme more efficient than Cramer. 

In Cramer, the public key includes one element "d" as shown in Fig. 
2 and as discussed at column 7, lines 26 to 39 thereof. The element "d" as 
per Cramer relates to the two elements y1 and y2 of the private key. 
Cramer does not disclose the detailed structure of the public key, as 
recited in independent claims 23, 24, 28, and 30. Further, the Examiner 
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does not indicate the relation of each element of the public key between 
Cramer and the present invention. 

In the present invention, as recited in independent claims 23, 24, 28, 
and 30, the public key includes two elements "d1" and "d2". The "d1" and 
"d2" of the present invention respectively relate to the two elements y1 1 
and y12, and y21 and y22 of the private key. Each of independent claims 
23, 24, 28 and 30 of the present application includes "d1" and "d2" in the 
public key at the key generation step. The ciphertext generating step of 
the present invention, as recited in independent claims 23, 24, 28, and 30, 
uses the two elements "d1" and u d2", and the ciphertext decipher step of 
the present invention, as recited in independent claims 23, 24, 28, and 30, 
uses the four elements of y1 1 , y1 2, y21 and y22 of the private key. 

A particularity exists in the field of cryptosystem algorithm. Even if the 
security and the computation amount are largely improved in the 
cryptosystem, the difference between the conventional algorithm and the new 
algorithm appears to be very small when they are expressed by the 
mathematical expressions. If the difference on the mathematical expressions 
is small, the theory to make the difference is not small and the effect derived 
from the difference is large. 

The features of the present invention, as recited in independent claims 
23, 24, 28, and 30, include two d parameters (i.e., "d1" and "d2"). Adding 
more parameters to the key generation steps will greatly increase the 
computation amount. In the cryptosystem in Cramer, the computation amount 
is large (see, e.g., A Practical Public Key Cryptosystem Provably Secure 
against Adaptive Chosen Ciphertext Attack ("Cramer treatise")), which is 
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written by the inventors of Cramer patent and appears to show the detailed 
algorithm of the Cramer patent (U.S. Patent No. 6,697,488). The variables 
used in the expressions of the Cramer treatise and the Cramer patent are 
identical. 

Assume the message m is encrypted as follows in Cramer: 
ui=(gi) r mod p 
u 2 = (g2) r mod p 
e=mh r mod p, 

v=c r d rZ , where z=H(ui ,U2,e) and H is a hash function. 
The variables p and q are prime numbers satisfying q/p-1 , which means that 
p-1 is divisible by q. The order of gi and g 2 is q and p is around 1024 bits. 

In the hash-free variant (page 15, section 5.3 of Cramer treatise), the 
following replacement is performed: 

At first, (ui, u 2 , e) is replaced with (ai,...,a k ), where 0 < a\ < q. 

Further, di=( gi) y - {i1> ( g2) yJi2} mod p, where 0<i<k is calculated and 
made open. 

In the above-mentioned encryption, the calculation of v is replaced 

with: 

v=c r (di) ra - 1 ...(d k ) ra - k 
As mentioned above, the number of di is determined by the value of k. 
To improve the efficiency of the encryption system, i.e. to reduce the 
calculation amount of v, it is preferable that the number of d (the value of k) is 
small. 

In the Cramer patent, when p-1 = 2q, k can be 3. Since the value of q 
is large in this case, the calculation amount of Ui and u 2 will be large, which is 
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a problem of Cramer. Conversely, when the value of q is set around 160 bits, 
k will be more than 20 and the calculation amount of v becomes large. 

The present invention provides an encryption system in which the 
value of k is kept small (k is 2) and the calculation amount of Ui and u 2 is also 
kept small. The number of plural dj is more than 3 in Cramer while the 
number of dj is 2 in the present invention. This difference contributes the 
computation amount reduction. Accordingly, the present invention is different 
from Cramer in at least the number of dj, which is not a simple parameter 
addition. 

Thus, the present invention as recited in the claims differs 
substantially from Cramer in that Cramer fails to teach or suggest the key 
generation step, ciphertext generation step and ciphertext decipher step as 
recited in the claims. 

/. Independent Claim 23 

One feature of the present invention, as recited in independent claim 
23, includes a key generation step of generating a secret key and a public 
key. The secret key includes xi, x 2> yn, yi2, y2i, y22, and z. The public key 
includes elements di and d2. The element di relates to the elements yn and 
yi2 of the secret key, and the element d2 relates to the elements y2i and y22 of 
the secret key. Cramer does not disclose this feature. To support the 
assertion that Cramer teaches a key generation step of generating a secret 
key and a public key, in the manner claimed, the Examiner cites column 7, 
lines 1-67. However, neither the cited text, nor any other portion of Cramer, 
teaches the claimed feature. 
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For example, as described in column 7, lines 11-19, Cramer discloses 
where a first exponent-number xi, a second exponent-number x 2 , a third 
exponent-number Z, a fourth exponent-number yi, and a fifth exponent- 
number y 2 , are chosen at random for the private key. As such, Cramer 
discloses the use of elements yi and y 2 . To the contrary, in the present 
invention, the secret key includes yn, yi 2 , y 2 i, y 22 . Cramer does not teach or 
suggest the additional elements of the claimed invention. 

By way of further example, as described in column 7, lines 25-27, 
Cramer discloses where the public key is "represented by the numbers gi, g 2 , 
c, d, and h." Accordingly, Cramer only discloses one element d, whereas the 
present invention discloses where the public key includes both an element di 
and an element d 2 . As such, Cramer fails to teach or suggest where the 
public key includes both elements di and d 2 , as in the present invention. 

On page 9 of the Office Action (see, e.g., the last paragraph) mailed on 
February 7, 2007, and in the Advisory Action mailed on September 21, 2006, 
the Examiner appears to concede that Cramer does not teach where the 
secret key includes all of the elements yn, yi 2 , y 2 i, y 22 of the present 
invention. However, the Examiner contends that "it would have been obvious 
to one having ordinary skill in the art at the time the invention was made to 
generate the secret key by modifying Cramer's generating step." The 
Examiner further contends that "One of ordinary skill in the art would have 
been motivated to do so to increase the security of the cryptographic 
scheme", citing column 3, lines 1-67 and column 4, lines 1-67 of Cramer. 

However, the cited text does not provide the motivation relied upon by 
the Examiner to modify Cramer's generating step. Instead, the Examiner has 



23 



resorted to hindsight, based upon Applicants' disclosure, rather than relying 
upon facts gleaned from the prior art. Therefore, the Examiner has relied 
upon impermissible hindsight to conclude that it would be obvious to modify 
Cramer to obtain the present invention. 

Furthermore, as described in column 9, lines 65-67, Cramer describes 
where, in order to achieve security against lunch-time attacks, "one can 
simplify the above-described basic scheme" by omitting d, yi and y 2 . As such, 
Cramer teaches away from adding additional elements, so as to include both 
elements di and 62 in the public key, and each of elements yn, yi2, y2i, V22 in 
the secret key. Therefore, contrary to the Examiner's assertions, it would not 
be obvious to modify Cramer to add the additional elements, so as to achieve 
the present invention. 

Therefore, Cramer fails to teach or suggest " a key generation step of 
generating a secret-key: 

• ^1,^2, 3/11,2/12,2/21, 2/22, * € Z q 

and a public-key: 

• : finite (multiplicative) group G C(?' 

• q : prime number (the order of G) 

• 9i,92 

• c = 9i x '92 x \ d x = 9x y "92 yi \ d 2 = 9l v * l 92 V2 \ h = g x \ 

• 7r : X\ x X 2 x M — > G f : one-to-one mapping 

• 7T" 1 : Im(7r) — ► X x x X 2 x M 

where the group G is a partial group of the group G'. Xi and X? are an infinite 

set of positive integers which satisfy: ^ 

\ 

oti\\a 2 <q (Vai € X u Va 2 € X 2 ) 

where M is a plaintext space " as recited in independent claim 23. 
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Another feature of the present invention, as recited in independent 
claim 23, includes a ciphertext generation and transmission step of selecting 
random numbers for a plaintext m, calculating ui, u 2 , e, and v, where: 

e = TT(aua 2 ,m)h r , and v = gf 1 c r df' d 2 mr . 
Cramer does not disclose this feature. To support the assertion that Cramer 
teaches a ciphertext generation and transmission step, in the manner 
claimed, the Examiner cites column 7, lines 1-67 and column 8, lines 1-67. 
Neither the cited text, nor any other portion of Cramer, teaches the claimed 
feature. 

For example, as described in column 7, line 56 to column 8, line 21 , 
Cramer discloses where the encryption means computes a first universal 
cipher-number ui, an encryption cipher-number e, a hash-value a, and a 
verification cipher-number v. The verification cipher-number v is based on the 
first group-number c, the third group-number d, the hash-value a, and the 
single exponent-number r. The present invention, as recited in claim 23, does 
not rely upon a hash function, and thus, does not use a hash-value a. In this 
way, for example, Cramer is clearly different from the claimed invention. 
Specifically, the verification cipher-number v, as calculated in Cramer (i.e., v = 
d d a ) is quite different from v, as calculated in the present invention (i.e., v = 
gi a1 c r di ar d 2 mr ), and the Examiner has not provided any explanation as to 
why one of ordinary skill in the art would be motivated to modify Cramer to 
obtain this feature. 

By way of further example, as shown in column 8, line 5, Cramer 
discloses where the encryption cipher-number e is calculated according to the 
following formula: e = h r m. This is quite different from the present invention, 
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where e = rr (a 1f 02, m) h r , and the Examiner has not provided any explanation 
as to why one of ordinary skill in the art would be motivated to modify Cramer 
to obtain this feature. 

Therefore, Cramer fails to teach or suggest " a ciphertext generation 
and transmission step of selecting random numbers o^ Xi, a ^X?. r ^Z q for a 
plaintext m (m p IVh. calculating: 

u\ = 91 ', u 2 = 92 r , e = 7r(ai,a 2 ,m)ft r , v = gi* 1 c r d x ar d 2 mr 

where a = ai |l o?, and transmitting (ui, up, e, v) as a ciphertext " as recited in 
independent claim 23. 

Yet another feature of the present invention, as recited in independent 
claim 23, includes a ciphertext reception and decipher step. This step 
includes a condition, such that a step is performed of outputting m' as the 
deciphered results, if the following is satisfied: 

If the above condition is not satisfied, then a step is performed of outputting as 
the decipher results the effect that the received ciphertext is rejected. Cramer 
does not disclose this feature. To support the assertion that Cramer teaches 
this feature, the Examiner cites columns 9-1 1 . However, neither the cited 
text, nor any other portions of Cramer, teach or suggest the claimed features. 

For example, as described in column 8, lines 50-62, Cramer discloses 
a condition [1]: u* Uy1a if 2 + y2a = v. The condition [1] of Cramer is not the 
same as the above-described condition of the present invention. Accordingly, 
Cramer does not disclose the claimed feature, and the Examiner has not 
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provided any explanation as to why one of ordinary skill in the art would be 
motivated to modify Cramer to obtain this feature. 

Therefore, Cramer fails to teach or suggest " a ciohertext reception and 
decipher step of calculating from the received ciphertext and bv using the 
secret key, ay a>, m' (a'^X^ o'^X?. m'^M) which satisfy: 

7r(ai,a2,m') = eju\ 
and if the following is satisfied: 

outputting m' as the deciphered results (where a' = a'i II a'?), whereas if not 
satisfied, outputting as the decipher results the effect that the received 
ciphertext is rejected " as recited in independent claim 23. 

//. Independent Claim 24 

One feature of the present invention, as recited in independent claim 
24, includes a key generation step of generating a secret key and a public 
key. The secret key includes xi, x 2 , yn, yi2, y2i, y22, and z. The public key 
includes elements di and d 2 , and the elements c, di, d 2 , and h are calculated 
using modulo arithmetic. The element di relates to the elements yn and yi 2 
of the secret key, and the element d 2 relates to the elements y 2 i and y 22 of the 
secret key. Cramer does not disclose this feature. To support the assertion 
that Cramer teaches a key generation step of generating a secret key and a 
public key, in the manner claimed, the Examiner cites column 7, lines 1-67. 
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However, neither the cited text, nor any other portion of Cramer, teaches the 
claimed feature. 

For example, as previously discussed, column 7, lines 1 1-19 of Cramer 
describes where a first exponent-number xi, a second exponent-number x 2 , a 
third exponent-number Z, a fourth exponent-number y^ and a fifth exponent- 
number y 2 , are chosen at random for the private key. As such, Cramer 
discloses the use of elements yi and y 2 . To the contrary, in the present 
invention, the secret key includes yn, yi 2 , y2i, y22- Cramer does not teach or 
suggest the additional elements of the claimed invention. 

By way of further example, as previously discussed, column 7, lines 
25-27 of Cramer describes where the public key is "represented by the 
numbers gi, g 2 , c, d, and h." Accordingly, Cramer only discloses one element 
d, whereas the present invention discloses where the public key includes both 
an element di and an element d 2 . As such, Cramer fails to teach or suggest 
where the public key includes both elements di and d 2l as in the present 
invention. 

As previously discussed, and contrary to the Examiner's assertions, 
Cramer does not provide the motivation relied upon by the Examiner to modify 
Cramer's generating step. Instead, the Examiner has resorted to hindsight, 
based upon Applicants' disclosure, rather than relying upon facts gleaned 
from the prior art. Therefore, the Examiner has relied upon impermissible 
hindsight to conclude that it would be obvious to modify Cramer to obtain the 
present invention. 

Furthermore, as previously discussed, Cramer teaches away from 
adding additional elements to obtain the present invention. As described in 
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column 9, lines 65-67, Cramer describes where, in order to achieve security 
against lunch-time attacks, "one can simplify the above-described basic 
scheme" by omitting d, y^ and y 2 . As such, Cramer teaches away from adding 
additional elements, so as to include both elements di and d 2 in the public 
key, and each of elements yn, yi 2 , y 2 i, V22 in the secret key. Therefore, 
contrary to the Examiner's assertions, it would not be obvious to modify 
Cramer to add the additional elements, so as to achieve the present invention. 

By way of even further example, column 7, lines 25-27 of Cramer 
describes where the public key is "represented by the numbers gi, g 2 , c, d, 
and h", and column 7, line 25 shows the calculations used to derive the 
numbers c, d and h. As shown, Cramer does not disclose the use of modulo 
arithmetic in the equations used to calculate c, d and h. This is quite different 
from the present invention, where the step of generating a public key includes 
the elements c, di, d 2 , and h, which are calculated using modulo arithmetic. 
Accordingly, Cramer does not teach generating a public key in the manner 
claimed, and the Examiner has not provided any explanation as to why one of 
ordinary skill in the art would be motivated to modify Cramer to obtain this 
feature. 

Therefore, Cramer fails to teach or suggest " a kev generation step of 
generating a secret-kev: 

• a;i,x 2 ,yii,yi2,y2i>2/22>2 € Z q 

and a public-key: 

• P> Q : prime number (q is a prime factor of p- 1 ) 

• 91 j 92 € Zp : ordp(pi) = ord p (p 2 ) = q 

• c = gi Xl g2 X2 mod p, di = gi vil g2 yi2 mod p, d 2 = g\ V21 g2 V22 mod p, h = g\ z mod p, 

• *i, k 2 ,k 3 : positive constant (I0 fcl+/ca < q y 10 k * < q y 10 kl + k2 + k3 < p) 
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" as recited in independent claim 24. 

Another feature of the present invention, as recited in independent 
claim 24, includes a ciphertext generation and transmission step of selecting 
random numbers for a plaintext m, calculating Ui, U2, e, and v, where: 

u\ = g\ r mod p, U2 = 9<i mod p, e = m h r mod p, v = gi ai c r di ar d2 Tnr mod p 

Cramer does not disclose this feature. To support the assertion that Cramer 
teaches a ciphertext generation and transmission step, in the manner 
claimed, the Examiner cites column 8, lines 1-67. Neither the cited text, nor 
any other portions of Cramer, teaches the claimed feature. 

For example, as described in column 7, line 56 to column 8, line 21 , 
Cramer discloses where the encryption means computes a first universal 
cipher-number ui, an encryption cipher-number e, a hash-value a, and a 
verification cipher-number v. The verification cipher-number v is based on the 
first group-number c, the third group-number d, the hash-value a, and the 
single exponent-number r. The present invention, as recited in claim 24, does 
not rely upon a hash function, and thus, does not use a hash-value a. In this 
way, for example, Cramer is clearly different from the claimed invention. 
Specifically, the verification cipher-number v, as calculated in Cramer (i.e., v = 
d d a ) is quite different from v, as calculated in the present invention (i.e., v = 
g" 1 c r di ar d 2 mr mod p), and the Examiner has not provided any explanation as 
to why one of ordinary skill in the art would be motivated to modify Cramer to 
obtain this feature. 
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By way of further example, as shown in column 8, line 5, Cramer 
discloses the formulas used for calculating ui, U2, e, and v. As shown, 
Cramer does not disclose the use of modulo arithmetic in the equations used 
to calculate Ui, u 2 , e, and v. This is quite different from the present invention, 
where the step of generating a public key includes where the elements Ui, U2, 
e, and v are calculated using modulo arithmetic. Accordingly, Cramer does 
not teach generating a public key in the manner claimed, and the Examiner 
has not provided any explanation as to why one of ordinary skill in the art 
would be motivated to modify Cramer to obtain this feature. 

Therefore, Cramer fails to teach or suggest " a ciphertext generation 
and transmission step of selecting random numbers a = cm || a? (|oi| - ki. la?! 
= k?) for a plaintext m (|m| = ka where |x | is the number of digits of x). 
calculating: 

m = a\\K 

selecting a random number feZo, calculating: 

u\ = gx r mod p, 112 = g<{ mod p, e = m h r mod p, v = gi ai c r di ar d2 Tnr mod p 

and transmitting (u^ u?, e, v) as a ciphertexf as recited in independent 
claim 24. 

Yet another feature of the present invention, as recited in independent 
claim 24, includes a ciphertext reception and decipher step. This step 
includes a condition, such that a step is performed of outputting nY as the 
deciphered results, if the following is satisfied: 

Pi a,l ui xlWvu+m/v2X ti2 X2+a ' vl34 * m ' V33 = v (mod p) 



31 



If the above condition is not satisfied, then a step is performed of outputting, 
as the decipher results, the effect that the received ciphertext is rejected. 
Cramer does not disclose this feature. To support the assertion that Cramer 
teaches this feature, the Examiner cites columns 9-1 1 . However, neither the 
cited text, nor any other portions of Cramer, teach or suggest the claimed 
features. 

For example, as described in column 8, lines 50-62, Cramer discloses 
a condition [1]: ui x1+y1a if 2 ** 2 * = v. The condition [1] of Cramer is not the 
same as the above-described condition of the present invention. Accordingly, 
Cramer does not disclose the claimed feature, and the Examiner has not 
provided any explanation as to why one of ordinary skill in the art would be 
motivated to modify Cramer to obtain this feature. 

Therefore, Cramer fails to teach or suggest " a ciphertext reception and 
decipher step of calculating from the received ciphertext and by using the 
secret key, o'i. a'?, m' (laM = ki, la'pl = k?. Im'| = which satisfy: 

a ill a 2ll m ' — e / u i z modp 

and if the following is satisfied: 

p 1 a iu 1 Xl+a ^iWy2i U2 x a +a'yi2Wy 22 = v ( mo d p ) 

outputting m' as the deciphered results (where o' = o'i || a'?), whereas if not 
satisfied, outputting as the decipher results the effect that the received 
ciphertext is rejected " as recited in independent claim 24. 
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///. Independent Claim 28 

One feature of the present invention, as recited in independent claim 
28, includes a key generation step of generating a secret key and a public 
key. The secret key includes Xi, x 2 , yn, yi2, y2i, y22» and z. The public key 
includes elements di and d 2 . The element di relates to the elements yn and 
y 12 of the secret key, and the element d 2 relates to the elements y 2 i and y 22 of 
the secret key. Cramer does not disclose this feature. To support the 
assertion that Cramer teaches a key generation step of generating a secret 
key and a public key, in the manner claimed, the Examiner cites column 7, 
lines 1-67. However, neither the cited text, nor any other portion of Cramer, 
teaches the claimed feature. 

For example, as previously discussed, column 7, lines 1 1-19 of Cramer 
describes where a first exponent-number xi, a second exponent-number x 2 , a 
third exponent-number Z, a fourth exponent-number y lf and a fifth exponent- 
number y 2 , are chosen at random for the private key. As such, Cramer 
discloses the use of elements yi and y 2 . To the contrary, in the present 
invention, the secret key includes yn, yi 2 , y2i, y22- Cramer does not teach or 
suggest the additional elements of the claimed invention. 

By way of further example, as previously discussed, column 7, lines 
25-27 of Cramer describes where the public key is "represented by the 
numbers gi, g 2 , c, d, and h." Accordingly, Cramer only discloses one element 
d, whereas the present invention discloses where the public key includes both 
an element di and an element d 2 . As such, Cramer fails to teach or suggest 
where the public key includes both elements di and d 2 , as in the present 
invention. 
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As previously discussed, and contrary to the Examiner's assertions, 
Cramer does not provide the motivation relied upon by the Examiner to modify 
Cramer's generating step. Instead, the Examiner has resorted to hindsight, 
based upon Applicants' disclosure, rather than relying upon facts gleaned 
from the prior art. Therefore, the Examiner has relied upon impermissible 
hindsight to conclude that it would be obvious to modify Cramer to obtain the 
present invention. 

Furthermore, as previously discussed, Cramer teaches away from 
adding additional elements to obtain the present invention. As described in 
column 9, lines 65-67, Cramer describes where, in order to achieve security 
against lunch-time attacks, "one can simplify the above-described basic 
scheme" by omitting d, yi and yz. As such, Cramer teaches away from adding 
additional elements, so as to include both elements di and d 2 in the public 
key, and each of elements yn, yi 2 , y2i, y22 in the secret key. Therefore, 
contrary to the Examiner's assertions, it would not be obvious to modify 
Cramer to add the additional elements, so as to achieve the present invention. 

Therefore, Cramer fails to teach or suggest " a key generation step of 
generating a secret-key: 

• xi,x 2 ,j/n,yi2,y2i,y22,2 € Z g 
and a public-key: 

• G,G* : finite (multiplicative) group G C G' 

• q : prime number (the order of G) 

• 9i,92 6 G 

•c = <7i Xl <72* 2 > d x = pi^W 12 , d 2 = 9l V2l 92 V22 > h = 9 \ z > 

• 7r : X\ x X2 x M — > G 1 : one-to-one mapping 

• tt" 1 : Im(7r) — > X x x X 2 x M 

• E : symmetric encipher function 
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where the group G is a partial group of the group G', X 1 and X? are an infinite 
set of positive integers which satisfy: 

ai||a 2 < q (Vai G X u Va 2 e X 2 ) 

where M is a key space " as recited in independent claim 28 of the present 
invention. 

Another feature of the present invention, as recited in independent 
claim 28, includes a ciphertext generation and transmission step of selecting 
random numbers for key data K, calculating ui, U2, e, and v, where: 

e = tt (a h a 2 , K) h r , and v = g, a1 c r df' d 2 Kr . 
Cramer does not disclose this feature. To support the assertion that Cramer 
teaches a ciphertext generation and transmission step, in the manner 
claimed, the Examiner cites column 7, lines 1-67 and column 8, lines 1-67. 
Neither the cited text, nor any other portion of Cramer, teaches the claimed 
feature. 

For example, as described in column 7, line 56 to column 8, line 21 , 
Cramer discloses where the encryption means computes a first universal 
cipher-number ui, an encryption cipher-number e, a hash-value a, and a 
verification cipher-number v. The verification cipher-number v is based on the 
first group-number c, the third group-number d, the hash-value a, and the 
single exponent-number r. The present invention, as recited in claim 28, does 
not rely upon a hash function, and thus, does not use a hash-value a. In this 
way, for example, Cramer is clearly different from the claimed invention. 
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Specifically, the verification cipher-number v, as calculated in Cramer (i.e., v = 
d d 3 ) is quite different from v, as calculated in the present invention (i.e., v = 
g" 1 d di ar d 2 Kr ), and the Examiner has not provided any explanation as to why 
one of ordinary skill in the art would be motivated to modify Cramer to obtain 
this feature. 

By way of further example, as shown in column 8, line 5, Cramer 
discloses where the encryption cipher-number e is calculated according to the 
following formula: e = h r m. This is quite different from the present invention, 
where e = tt (a 1f a 2 , K) h r , and the Examiner has not provided any explanation 
as to why one of ordinary skill in the art would be motivated to modify Cramer 
to obtain this feature. 

Therefore, Cramer fails to teach or suggest " a ciohertext generation 
and transmission step of selecting random numbers OigXi. a?g X?. fe Zo for key 
data K (K ft M), calculating: 

u\ = g\ r , u 2 = 92 r y e = 7r(ai,a2,i^)/t r , v = gi ai c r di ar d 2 Kr 
where a = ai II a?, generating a ciphertext C of transmission data m by: 

C = E K (m) 

bv using a (symmetric cryptographic function E and kev data K. and 
transmitting (ui . u?. e, v. C) as the ciphertext " as recited in independent claim 
28. 

Yet another feature of the present invention, as recited in independent 
claim 28, includes a ciphertext reception and decipher step. This step 
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includes a condition, such that a step is performed of executing a decipher 
process, if the following is satisfied: 

If the above condition is not satisfied, then a step is performed of outputting as 
the decipher results the effect that the received ciphertext is rejected. Cramer 
does not disclose this feature. To support the assertion that Cramer teaches 
this feature, the Examiner cites columns 9-1 1 . However, neither the cited 
text, nor any other portions of Cramer, teach or suggest the claimed features. 

For example, as described in column 8, lines 50-62, Cramer discloses 
a condition [1]: ui x1+y1a \f 2+y2a = v. The condition [1 ] of Cramer is not the 
same as the above-described condition of the present invention. Accordingly, 
Cramer does not disclose the claimed feature, and the Examiner has not 
provided any explanation as to why one of ordinary skill in the art would be 
motivated to modify Cramer to obtain this feature. 

Therefore, Cramer fails to teach or suggest " a ciphertext reception and 
decipher step of calculating from the received ciphertext and by using the 
secret key, a'i. a'?, K' (a'l^X^ a'^X?, K'gM) which satisfy: 

*{a\\\a' 2 \\K') = efuS 
and if the following is satisfied: 

where a' = a'i || a'? 

executing a decipher process bv: 
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m = D K ,{C) 

outputtina deciphered results, whereas if not satisfied, outputtinq as the 
decipher results the effect that the received ciphertext is rejected " as recited in 
independent claim 28. 

iv. Independent Claim 30 

One feature of the present invention, as recited in independent claim 
30, includes a key generation step of generating a secret key and a public 
key. The secret key includes xi, x 2 , yn, yi2, y2i, y22, and z. The public key 
includes elements di and d 2 . The element di relates to the elements yn and 
yi2 of the secret key, and the element d 2 relates to the elements y 2 i and y 2 2 of 
the secret key. Cramer does not disclose this feature. To support the 
assertion that Cramer teaches a key generation step of generating a secret 
key and a public key, in the manner claimed, the Examiner cites column 7, 
lines 1-67. However, neither the cited text, nor any other portion of Cramer, 
teaches the claimed feature. 

For example, as previously discussed, column 7, lines 1 1-19 of Cramer 
describes where a first exponent-number xi, a second exponent-number x 2 , a 
third exponent-number Z, a fourth exponent-number y 1f and a fifth exponent- 
number y 2 , are chosen at random for the private key. As such, Cramer 
discloses the use of elements yi and y2. To the contrary, in the present 
invention, the secret key includes yn, yi 2 , y2i, y22. Cramer does not teach or 
suggest the additional elements of the claimed invention. 

By way of further example, as previously discussed, column 7, lines 
25-27 of Cramer describes where the public key is "represented by the 
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numbers gi, g2, c, d, and h." Accordingly, Cramer only discloses one element 
d, whereas the present invention discloses where the public key includes both 
an element di and an element d 2 . As such, Cramer fails to teach or suggest 
where the public key includes both elements di and d 2 , as in the present 
invention. 

As previously discussed, and contrary to the Examiner's assertions, 
Cramer does not provide the motivation relied upon by the Examiner to modify 
Cramer's generating step. Instead, the Examiner has resorted to hindsight, 
based upon Applicants' disclosure, rather than relying upon facts gleaned 
from the prior art. Therefore, the Examiner has relied upon impermissible 
hindsight to conclude that it would be obvious to modify Cramer to obtain the 
present invention. 

Furthermore, as previously discussed, Cramer teaches away from 
adding additional elements to obtain the present invention. As described in 
column 9, lines 65-67, Cramer describes where, in order to achieve security 
against lunch-time attacks, "one can simplify the above-described basic 
scheme" by omitting d, yi and y 2 . As such, Cramer teaches away from adding 
additional elements, so as to include both elements di and d 2 in the public 
key, and each of elements yn, yi 2 , y 2 i, y^ in the secret key. Therefore, 
contrary to the Examiner's assertions, it would not be obvious to modify 
Cramer to add the additional elements, so as to achieve the present invention. 

Therefore, Cramer fails to teach or suggest " a kev generation step of 
generating a secret-kev: 

• ^1,22,2/11,2/12,2/21,2/22,2 £ %q 
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and a public-kev : 

• Pi Q '• prime number (q is a prime factor of p- 1 ) 

• 9i,92 <= Z p : ordp(pi) = ord p (p 2 ) = q 

• c = 9\ Xl 92 X2 mod p, di = g\ yil 92 Vl2 mod p, cfe = 9i V2l 92 V22 mod p, h = g\ z mod p, 

• *i, fc 2 , k 3 : positive constant (I0 fcl+fc2 < q, 10* 3 < I0 fcl +* a + fc 3 < p) 

• : symmetric encipher function 

" as recited in independent claim 30. 

Another feature of the present invention, as recited in independent 
claim 30, includes a ciphertext generation and transmission step of selecting 
random numbers for key data K, calculating ui, U2, e, and v, where: 

u>i = 9\ T mod p, U2 = 92 r mod p, e = m h r mod p, v = g\ ai c T d\ ar d,2 Kr mod p 

Cramer does not disclose this feature. To support the assertion that Cramer 
teaches a ciphertext generation and transmission step, in the manner 
claimed, the Examiner cites columns 7, 8 and 12. However, neither the cited 
text, nor any other portions of Cramer, teaches the claimed feature. 

For example, as described in column 7, line 56 to column 8, line 21, 
Cramer discloses where the encryption means computes a first universal 
cipher-number ui, an encryption cipher-number e, a hash-value a, and a 
verification cipher-number v. The verification cipher-number v is based on the 
first group-number c, the third group-number d, the hash-value a, and the 
single exponent-number r. The present invention, as recited in claim 30, does 
not rely upon a hash function, and thus, does not use a hash-value a. In this 
way, for example, Cramer is clearly different from the claimed invention. 
Specifically, the verification cipher-number v, as calculated in Cramer (i.e., v = 
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d df a ) is quite different from v, as calculated in the present invention (i.e., v = 
gi a1 c r di ar d 2 Kr mod p), and the Examiner has not provided any explanation as 
to why one of ordinary skill in the art would be motivated to modify Cramer to 
obtain this feature. 

By way of further example, as shown in column 8, line 5, Cramer 
discloses the formulas used for calculating Ui, u 2 , e, and v. As shown, 
Cramer does not disclose the use of modulo arithmetic in the equations used 
to calculate Ui, u 2 , e, and v. This is quite different from the present invention, 
where the step of generating a public key includes where the elements ui, u 2 , 
e, and v are calculated using modulo arithmetic. Accordingly, Cramer does 
not teach generating a public key in the manner claimed, and the Examiner 
has not provided any explanation as to why one of ordinary skill in the art 
would be motivated to modify Cramer to obtain this feature. 

Therefore, Cramer fails to teach or suggest " a ciphertext generation 
and transmission step of selecting random numbers a = Qi |l a? (Ion I = ki. |a?| 
= k?) for key data K (IKI = ka where Ixl is the number of digits of x), calculating: 

m =a\\K 

selecting a random number r^Zo, calculating: 

u\ = gi r mod p, U2 = g-i mod p, e = m h r mod p, v = gi ai c r di° cr d2 Kr mod p 

and generating a ciphertext C of transmission data bv: 

C = E K {m) 

bv using a (symmetric) cryptographic function E and the key data K. and 
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transmitting (ui. u?. e. v. C) as the ciphertext " as recited in independent claim 
30. 

Yet another feature of the present invention, as recited in independent 
claim 30, includes a ciphertext reception and decipher step. This step 
includes a condition, such that a step is performed of executing a decipher 
process, if the following is satisfied: 

yi a iui Xl+a/yu+ ^' V21 U2 a:2+a/l/13+iC ' V3a s v (mod p) 

If the above co. ,ed of outputting, 

as the decipher results, the effect that the received ciphertext is rejected. 
Cramer does not disclose this feature. To support the assertion that Cramer 
teaches this feature, the Examiner cites columns 9-1 1 . However, neither the 
cited text, nor any other portions of Cramer, teach or suggest the claimed 
features. 

For example, as described in column 8, lines 50-62, Cramer discloses 
a condition [1]: ui xUy1a \f 2+ * 2a = v. The condition [1] of Cramer is not the 
same as the above-described condition of the present invention. Accordingly, 
Cramer does not disclose the claimed feature, and the Examiner has not 
provided any explanation as to why one of ordinary skill in the art would be 
motivated to modify Cramer to obtain this feature. 

Therefore, Cramer fails to teach or suggest " a ciphertext reception and 
decipher step of calculating from the received ciphertext and bv using the 
secret key. o'i. o'?. K' (Ig'i) = ki. Iq'pI = k*. IK'I = k*) which satisfy: 

and if the following is satisfied: 
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g l <ui Xl + a ' Vll + K '* 1 U2* 2 + a ' yi2 + K ' y22 = v (mod p) 

where a' = II a'?, 

executing a decipher process bv: 

m = D K ,{C) 

outputtinq deciphered results, whereas if not satisfied, outputting as the 
decipher results the effect that the received ciphertext is rejected " as recited in 
independent claim 30. 

v. Independent Claim 35 

One feature of the present invention, as recited in independent claim 
35, includes a ciphertext generation and transmission step of selecting 
random numbers, calculating ui, u 2 , v, and K, where: 

v = g 1 a1 c r (f r , and K=H(h r ) . 
Cramer does not disclose this feature. To support the assertion that Cramer 
teaches a ciphertext generation and transmission step, in the manner 
claimed, the Examiner cites columns 7 and 8, and column 12, lines 1-35. 
However, neither the cited text, nor any other portion of Cramer, teaches the 
claimed feature. 

For example, as described in column 7, line 56 to column 8, line 21 , 
Cramer discloses where the encryption means computes a first universal 
cipher-number ui, an encryption cipher-number e, a hash-value a, and a 
verification cipher-number v. The verification cipher-number v is based on the 
first group-number c, the third group-number d, the hash-value a, and the 
single exponent-number r. The present invention, as recited in claim 35, does 
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not rely upon the hash function in the calculation of v. Furthermore, unlike the 
present invention, Cramer does not rely upon gf 1 in the calculation of v. In 
this way, for example, Cramer is clearly different from the claimed invention. 
Specifically, the verification cipher-number v, as calculated in Cramer (i.e., v = 
d d 3 ) is quite different from v, as calculated in the present invention (i.e., v = 
gi a1 c r <f r ) 1 and the Examiner has not provided any explanation as to why one 
of ordinary skill in the art would be motivated to modify Cramer to obtain this 
feature. 

By way of further example, as shown in column 8, line 5, Cramer does 
not disclose where the ciphertext generation and transmission step includes 
the calculation of the element K (i.e., K = H(h r )), as in the present invention. 
Cramer merely discloses the calculation of the group of elements ui, U2, e, a, 
and v, which does not include the element K, and the Examiner has not 
provided any explanation as to why one of ordinary skill in the art would be 
motivated to modify Cramer to obtain this feature. 

Therefore, Cramer fails to teach or suggest " a ciphertext generation 
and transmission step of selecting random numbers ai c Xi. ap ^ X?. r^Zq, 
calculating: 

ui=gi r , u 2 =92 r , v = 9i c *c r <P r 1 K = H(h r ) 
where a = ai II ap, generating a ciphertext C of transmission data m by 

C = E K (7r(ai,ac2,m)) 

bv using a (symmetric) cryptograph ic function E: and transmitting (ui. up. v. C) 
as the ciphertext" as recited in independent claim 35. 
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Another feature of the present invention, as recited in independent 
claim 35, includes a ciphertext reception and decipher step. This step 
includes a condition, such that a step of outputting m' as the deciphered 
results if the following is satisfied: 

If the above condition is not satisfied, then a step of outputting as the decipher 
results the effect that the received ciphertext is rejected. Cramer does not 
disclose this feature. To support the assertion that Cramer teaches this 
feature, the Examiner cites columns 9-1 1 . However, neither the cited text nor 
any other portions of Cramer, teach or suggest the claimed features. 

For example, as described in column 8, lines 50-62, Cramer discloses 
a condition [1]: Ui xUy1a if 2 ** 2 * = v. The condition [1] of Cramer is not the 
same as the above-described condition of the present invention. Accordingly, 
Cramer does not disclose the claimed feature, and the Examiner has not 
provided any explanation as to why one of ordinary skill in the art would be 
motivated to modify Cramer to obtain this feature. 

Therefore, Cramer fails to teach or suggest " a ciphertext reception and 
decipher step of calculating: 

bv using the secret key, calculating from the received ciphertext. ay ay 
(where o , i£X 1 Q> gX ;>) which satisfy: 

7r(a , 1 ,a , 2 ,m') = D iC /(C) 
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if the following is satisfied: 

p 1 a iui Xl+0 ' Vl « 2 aS2+a ' va = v, 
where a 1 = a'i || a'? 

outputtina m' as the deciphered results, whereas if not satisfied, outputtinq as 
the decipher results the effect that the received ciphertext is rejected " as 
recited in independent claim 35. 

vL Independent Claim 36 

One feature of the present invention, as recited in independent claim 
36, includes a ciphertext generation and transmission step of selecting 
random numbers, calculating ui, u 2 , v, and K, where: 

u\ = g x r mod p, U2 = 92 r mod p, v ~ g\ ctl d r d cxr mod p, K = H(h r mod p) 

Cramer does not disclose this feature. To support the assertion that Cramer 
teaches a ciphertext generation and transmission step, in the manner 
claimed, the Examiner cites columns 7 and 8, and column 12, lines 1-35. 
However, neither the cited text, nor any other portion of Cramer, teaches the 
claimed feature. 

For example, as described in column 7, line 56 to column 8, line 21, 
Cramer discloses where the encryption means computes a first universal 
cipher-number ui, an encryption cipher-number e, a hash-value a, and a 
verification cipher-number v. The verification cipher-number v is based on the 
first group-number c, the third group-number d, the hash-value a, and the 
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single exponent-number r. The present invention, as recited in claim 36, does 
not rely upon the hash function in the calculation of v. Furthermore, unlike the 
present invention, Cramer does not rely upon g? 1 in the calculation of v. In 
this way, for example, Cramer is clearly different from the claimed invention. 
Specifically, the verification cipher-number v, as calculated in Cramer (i.e., v = 
d cf 3 ) is quite different from v, as calculated in the present invention (i.e., v = 
g° 1 c r <f r mod p), and the Examiner has not provided any explanation as to 
why one of ordinary skill in the art would be motivated to modify Cramer to 
obtain this feature. 

By way of further example, as shown in column 8, line 5, Cramer does 
not disclose where the ciphertext generation and transmission step includes 
the calculation of the element K (i.e., K= H(h r mod p)), as in the present 
invention. Cramer merely discloses the calculation of the group of elements 
Ui, u 2 , e, a, and v, which does not include the element K, and the Examiner 
has not provided any explanation as to why one of ordinary skill in the art 
would be motivated to modify Cramer to obtain this feature. 

By way of even further example, as shown in column 8, line 5, Cramer 
discloses the formulas used for calculating ui, u 2 , e, and v. As shown, 
Cramer does not disclose the use of modulo arithmetic in the equations used 
to calculate ui, u 2 , e, and v. This is quite different from the present invention, 
where the step of generating a public key includes where the elements ui, u 2 , 
v, and K are calculated using modulo arithmetic. Accordingly, Cramer does 
not teach generating a public key in the manner claimed, and the Examiner 
has not provided any explanation as to why one of ordinary skill in the art 
would be motivated to modify Cramer to obtain this feature. 
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Therefore, Cramer fails to teach or suggest " a ciphertext generation 
and transmission step of selecting random numbers a = ch || a? QaJ = ki. Ia?j 
- k?. where ()x| is the number of digits of x), selecting a random number r^Zq. 
calculating: 

ui = gi r mod p, U2 = gz mod p, v = gi ai c r d ar mod p, if = if(/i r mod p) 

transmitting the ciphertext (ih, U?. v. C): generating a ciphertext C of 
transmission data m bv: 

C = JS? K (ai||a 2 ||m) 

by using a (symmetric) cryptographic function, and transmitting (ui. u?« v, C) 
as the ciphertext " as recited in independent claim 36. 

Another feature of the present invention, as recited in independent 
claim 36, includes a ciphertext reception and decipher step. This step 
includes a condition, such that a step of outputting m' as the deciphered 
results if the following is satisfied: 

9l a iui xl + a ' yi U2 X2+ot ' V2 = v (mod p) 

If the above condition is not satisfied, then a step of outputting as the decipher 
results the effect that the received ciphertext is rejected. Cramer does not 
disclose this feature. To support the assertion that Cramer teaches this 
feature, the Examiner cites columns 9-1 1 . However, neither the cited text nor 
any other portions of Cramer teach or suggest the claimed features. 

For example, as described in column 8, lines 50-62, Cramer discloses 
a condition [1]: ui x1+y1a u* 2+ y 2a = v . The condition [1] of Cramer is not the 
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same as the above-described condition of the present invention. Accordingly, 
Cramer does not disclose the claimed feature, and the Examiner has not 
provided any explanation as to why one of ordinary skill in the art would be 
motivated to modify Cramer to obtain this feature. 

Therefore, Cramer fails to teach or suggest "a ciphertext reception and 
decipher step of calculating: 

K 1 = H(m z mod p) 

bv using the secret kev. calculating from the received ciphertext. a'i. a'? (|a'i| 
= ki. |a'p| = kp) which satisfy: 

ot\\W 2 \\m 9 = D K ,(C) 
and if the following is satisfied: 

0i<u 1 Xl+o '* l u 2 X3 + a ' V2 = v (mod p) 

outputting m' as the deciphered results (where a' = a'i |l g'?), whereas if not 
satisfied, outputting as the decipher results the effect that the received 
ciphertext is rejected " as recited in independent claim 36. 

vii. Independent Claim 40 

One feature of the present invention, as recited in independent claim 
40, includes a ciphertext generation and transmission step of selecting 
random numbers, calculating ui, U2 and v, where: 
v = gi a1 c r cf r . 
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Cramer does not disclose this feature. To support the assertion that Cramer 
teaches a ciphertext generation and transmission step, in the manner 
claimed, the Examiner cites columns 7 and 8, and column 12, lines 1-35. 
However, neither the cited text, nor any other portion of Cramer, teaches the 
claimed feature. 

For example, as described in column 7, line 56 to column 8, line 21 , 
Cramer discloses where the encryption means computes a first universal 
cipher-number ui, an encryption cipher-number e, a hash-value a, and a 
verification cipher-number v. The verification cipher-number v is based on the 
first group-number c, the third group-number d, the hash-value a, and the 
single exponent-number r. The present invention, as recited in claim 40, does 
not rely upon the hash function, and thus, does not use a hash-value a. 
Furthermore, unlike the present invention, Cramer does not rely upon gf 1 in 
the calculation of v. In this way, for example, Cramer is clearly different from 
the claimed invention. Specifically, the verification cipher-number v, as 
calculated in Cramer (i.e., v = c r d 3 ) is quite different from v, as calculated in 
the present invention (i.e., v = gf 1 <? cf)> and the Examiner has not provided 
any explanation as to why one of ordinary skill in the art would be motivated to 
modify Cramer to obtain this feature. 

Therefore, Cramer fails to teach or suggest " a ciphertext generation 
and transmission step of selecting random numbers Oi g X^. a?gX?. r^ Za. 
calculating: 

ui = gx r , u 2 = 92 r , v = gi ai c r d ar 

where a = Qi || Qp. generating a ciphertext C of transmission data m by: 
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e = JS pfc (7r(ai,a2,m)) 

by using an (asymmetric) cryptographic function E pk , and transmitting (ui. Up. 
e, v) as the ciphertext " as recited in independent claim 40. 

Another feature of the present invention, as recited in independent 
claim 40, includes a ciphertext reception and decipher step. This step 
includes a condition, such that a step of outputting m' as the deciphered 
results if the following is satisfied: 

If the above condition is not satisfied, then a step of outputting as the decipher 
results the effect that the received ciphertext is rejected. Cramer does not 
disclose this feature. To support the assertion that Cramer teaches this 
feature, the Examiner cites columns 9-1 1 . However, neither the cited text nor 
any other portions of Cramer teach or suggest the claimed features. 

For example, as described in column 8, lines 50-62, Cramer discloses 
a condition [1]: u r xr+y7a if 2 ** 23 = v. The condition [1] of Cramer is not the 
same as the above-described condition of the present invention. Accordingly, 
Cramer does not disclose the claimed feature, and the Examiner has not 
provided any explanation as to why one of ordinary skill in the art would be 
motivated to modify Cramer to obtain this feature. 

Therefore, Cramer fails to teach or suggest " a ciphertext reception and 
decipher step of calculating from the received ciphertext and by using the 
secret kev. o'i . a'?, m' (oVX^ o' ?g X ? , nrV^M) which satisfy: 
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7r(ai,a2,m') = D ak {e) 

and if the following is satisfied: 
where: 

outputtinq m' as the deciphered results, whereas if not satisfied, outputting as 
the decipher results the effect that the received ciphertext is rejected " as 
recited in independent claim 40. 

vii. Independent Claim 41 

One feature of the present invention, as recited in independent claim 
41, includes a ciphertext generation and transmission step of selecting 
random numbers, calculating ui, u 2 and v, where: 

u\ = gi r mod p, tt2 = 92 r mod p, v = gi^^d** mod p 

Cramer does not disclose this feature. To support the assertion that Cramer 
teaches a ciphertext generation and transmission step, in the manner 
claimed, the Examiner cites columns 7 and 8, and column 12, lines 1-35. 
However, neither the cited text, nor any other portion of Cramer, teaches the 
claimed feature. 

For example, as described in column 7, line 56 to column 8, line 21, 
Cramer discloses where the encryption means computes a first universal 
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cipher-number m, an encryption cipher-number e, a hash-value a, and a 
verification cipher-number v. The verification cipher-number v is based on the 
first group-number c, the third group-number d, the hash-value a, and the 
single exponent-number r. The present invention, as recited in claim 41 , does 
not rely upon the hash function, and thus, does not user a hash-value a. 
Furthermore, unlike the present invention, Cramer does not rely upon g* 1 in 
the calculation of v. In this way, for example, Cramer is clearly different from 
the claimed invention. Specifically, the verification cipher-number v, as 
calculated in Cramer (i.e., v = c r d a ) is quite different from v, as calculated in 
the present invention (i.e., v = g* 1 d cf r mod p), and the Examiner has not 
provided any explanation as to why one of ordinary skill in the art would be 
motivated to modify Cramer to obtain this feature. 

By way of further example, as shown in column 8, line 5, Cramer 
discloses the formulas used for calculating ui, u 2 and v. As shown, Cramer 
does not disclose the use of modulo arithmetic in the equations used to 
calculate u<i, u 2 and v. This is quite different from the present invention, where 
the step of generating a public key includes where the elements Ui, u 2 and v, 
are calculated using modulo arithmetic. Accordingly, Cramer does not teach 
generating a public key in the manner claimed, and the Examiner has not 
provided any explanation as to why one of ordinary skill in the art would be 
motivated to modify Cramer to obtain this feature. 

Therefore, Cramer fails to teach or suggest " a ciphertext generation 
and transmission step of selecting random numbers a = || a? (\a^\ = k 1t |a?| 
= k ? , where |x| is the number of digits of x), selecting a random number r^Zq, 
calculating: 
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ui = gx r mod p, U2 = Q2 mod p, v = gi ai c r dP r mod p 

generating a ciphertext C of transmission data m (positive integer) bv: 

e = £p*(ai||a 2 ||m) 

by using the secret key, and transmitting (in. u ? . e. v) as the ciphertext " as 
recited in independent claim 41 . 

Another feature of the present invention, as recited in independent 
claim 41, includes a ciphertext reception and decipher step. This step 
includes a condition, such that a step of outputting m' as the deciphered 
results if the following is satisfied: 

g 1 a iui x *+ a ' in U2 X2 + Q ' V2 = v (mod p) 

If the above condition is not satisfied, then a step of outputting as the decipher 
results the effect that the received ciphertext is rejected. Cramer does not 
disclose this feature. To support the assertion that Cramer teaches this 
feature, the Examiner cites columns 9-1 1 . However, neither the cited text nor 
any other portions of Cramer teach or suggest the claimed features. 

For example, as described in column 8, lines 50-62, Cramer discloses 
a condition [1]: u* Uy1a a* 2 ** 2 * = v. The condition [1] of Cramer is not the 
same as the above-described condition of the present invention. Accordingly, 
Cramer does not disclose the claimed feature, and the Examiner has not 
provided any explanation as to why one of ordinary skill in the art would be 
motivated to modify Cramer to obtain this feature. 

Therefore, Cramer fails to teach or suggest " a ciphertext reception and 
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decipher step of calculating from t he received ciohertext and bv using the 
secret key, g'i. a'?, m' (|a'i| = ki. |a'p| = k?. m' is a positive integer) which 
satisfy: 

ai|K||m'=D, fc (e) 
and if the following is satisfied: 

^ai Ul *i+a'vi U2 x a +a'v2 = v ( mod p)> 

where: 

outputtino rrV as the deciphered results, whereas if not satisfied, outputting as 
the decipher results the effect that the received ciphertext is rejected " as 
recited in independent claim 41 . 

D. Conclusion 

Therefore, based on the above remarks, Appellants submit that the 
Examiner's final rejection of claims 25-27, 29, 31-34 and 37-39 under 35 USC 
§112, second paragraph; the rejection of claims 23-44 under 35 USC §101; 
and the rejection of claims 23-44 USC §1 03(a) are not properly founded in law 
and respectfully request that the Board of Patent Appeal Interferences reverse 
the Examiner's final rejection. 
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To the extent necessary, applicants petition for an extension of time 
under 37 CFR §1.136. Please charge any shortage in the fees due in 
connection with the filing of this paper, including extension of time fees, to 
Deposit Account No. 50-1417 (Case No. 500.41092X00) and please credit 
any excess fees to such Deposit Account. 

Respectfully submitted, 

MATTINGLY, STANGER, MALUR & BRUNDIDGE, P.C. 




Carl I. Brundi^ge 
Registration No. 29,621 



CIB/DKM/cmd 
(703) 684-1120 
Enclosures 
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VIII. CLAIMS APPENDIX 



Claims 1-22 (canceled). 

23. A public-key cryptographic method implemented in a computer 
system comprising: 

a key generation step of generating a secret-key: 

• si,z 2 ,2/ii,2/i2, 2/21, 2/22,* e z q 
and a public-key: 

• G,G' : finite (multiplicative) group G Cff 

• q : prime number (the order of G) 

• 9u 92 e G 

• c = 9\ Xx 92 X2 , di = gx y "g 2 yx2 > d 2 = 9i V21 92 V32 , h = g x z y 

• 7r : Xi x X2 x M — > G f : one-to-one mapping 

• tt^ 1 : Im(7r) X x x X 2 x M 

where the group G is a partial group of the group G\ X^ and X 2 are an infinite 
set of positive integers which satisfy: 

ai||a 2 < q (Vai 6 X u Va 2 € X 2 ) 

where M is a plaintext space; 

a ciphertext generation and transmission step of selecting random 
numbers cheXi, a 2 eX2, reZq for a plaintext m (m e M), calculating: 

u\ = gi r y u 2 = 92 r y e = 7r(ai, a 2 , m)h T ', v = p 1 ai c r cii ar d2 mr 

where a = ai || a 2 , and transmitting (ui, u 2 , e, v) as a ciphertext; and 

a ciphertext reception and decipher step of calculating from the 
received ciphertext and by using the secret key, a'i, a' 2 , m' (a'ieXi, a' 2 eX 2 , 
m'eM) which satisfy: 

7r(ai,a 2 ,m') = e/m z 
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and if the following is satisfied: 

outputting m' as the deciphered results (where a 1 = a'i || a' 2 ), whereas if not 
satisfied, outputting as the decipher results the effect that the received 
ciphertext is rejected. 

24. A public-key cryptographic method implemented in a computer 
comprising: 

a key generation step of generating a secret-key: 

• #1, ^2, 2/11, 2/12, 2/21, 2/22,* € Zq 

and a public-key: 

• P, Q : prime number (q is a prime factor of p- 1 ) 

• 9i,92 € Z p : ord p (gi) = ord p (p 2 ) = q 

• c = gi xl 92 X2 mod p> d\ = gi yil 92 V12 mod p, d<i = gi V21 92 V22 mod p> h = g\ z mod p, 

• *i, k 2l k 3 : positive constant (lO* 1 ^ 2 < q, 10 fc3 < q y 10 fcl+fc2+fc3 < p) 

a ciphertext generation and transmission step of selecting random 
numbers a = cm || q 2 (|ai| = ki, |a 2 | = k 2 ) for a plaintext m (|m| = k 3l where |x| is 
a number of digits of x), calculating: 

m = a \\K 

selecting a random number reZq, calculating: 

ui = gi r mod p, U2 — g-i mod p, e = m h r mod p, v = gi ai c r di ar d2 Tnr mod p 
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and transmitting (m, u 2 , e, v) as a ciphertext; and 

a ciphertext reception and decipher step of calculating from the 
received ciphertext and by using the secret key, a\, a' 2 , m' (|a'i| = k 1} |a' 2 | = k 2 , 
|m'| = k3) which satisfy: 

and if the following is satisfied: 

^i a iui Xl+a/vilWy21 U2 X2 ' f " a,vl2Wy23 s v (mod p) 

outputting m' as the deciphered results (where a' = a'i || 02), whereas if not 
satisfied, outputting as the decipher results the effect that the received 
ciphertext is rejected. 

25. A public-key cryptographic method according to claim 23, 
wherein the public-key is generated by a receiver and is made public. 

26. A public-key cryptographic method according to claim 23, 
wherein in said ciphertext transmission step, the random numbers a ie Xi, 
a 2 eX 2 and reZq are selected beforehand and the following is calculated and 
stored beforehand: 

27. A public-key cryptographic method according to claim 24, 
wherein in said ciphertext transmission step, the random numbers ch, a 2 (|ai| 
= ki, |a 2 | = k 2 ), and r e Zq are selected beforehand and the following is 
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calculated and stored beforehand: 

u\ = gi r mod p, U2 = 92 mod p, h r mod p, pi ai c r di ar mod p 

28. A cryptographic communication method implemented in a 
computer system comprising: 

a key generation step of generating a secret-key: 

• Xi,X2,J/ll, 2/12, 2/21,2/22,* ^ 

and a public-key: 

• G, G : finite (multiplicative) group G C G' 

• : prime number (the order of G) 

• 9u92 e G 

• c = gi Xl 92 X2 > d x = 9i y ^92 yx \ d 2 = Sl y21 02 ya3 , /i = <?i*, 

• 7r : Xi x A*2 x M — y G f : one-to-one mapping 

• 71- 1 : Im(7r) — ► Xi x X 2 x M 

• E : symmetric encipher function 

where the group G is a partial group of the group G', X^ and X 2 are an infinite 
set of positive integers which satisfy: 

c*i||a 2 < q (Vai 6 X\ y Va2 € X2) 

where M is a key space; 

a ciphertext generation and transmission step of selecting random 
numbers cheXi, a 2 eX 2 , r e Zq for key data K (K e M), calculating: 

ui = <7i r , u 2 = 92% e = ir(a u a 2l K)h r , v = gi ai c r d l ar d 2 Kr 



60 



where a = ai || 02, generating a ciphertext C of transmission data m by: 

C = E K (m) 

by using a symmetric cryptographic function E and key data K, and 
transmitting (ui, u 2 , e, v, C) as the ciphertext; and 

a ciphertext reception and decipher step of calculating from the 
received ciphertext and by using the secret key, a^, a' 2 , K' (a' ie Xi, a' 2 eX 2 , 
K'eM) which satisfy: 

n(a[\\a' 2 \\K') = e/u x * 

and if the following is satisfied: 

gi a ' l Ui xl+€ *' yil ~*~ K 1/21 ii 2 x 2+a'yi2+-K" f V22 = v 

where a' = a'i || a' 2 

executing a decipher process by: 

m = D K ,(C) 

outputting deciphered results, whereas if not satisfied, outputting as the 
decipher results the effect that the received ciphertext is rejected. 

29. A cryptographic communication method according to claim 28, 
wherein the ciphertext C is generated by: 

C = E K (f(a u a 2 )\\m) 

by using a symmetric cryptographic function E, the key data K and a 
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publicized proper function f, it is checked whether the following is satisfied: 
/K,a' 2 ) = [^(C)] fc 

where f outputs a value of k bits and [x] k indicates the upper k bits of x, and if 
the check passes, a decipher process is executed by: 

m=[D K ,(C)r k 

where [x]" k indicates a bit train with the upper k bits of x being removed. 

30. A cryptographic communication method implemented in a 
computer system comprising: 

a key generation step of generating a secret-key: 

• #1 ,X2, J/11 , 2/12,2/21, J/22, Z € %q 

and a public-key: 

• P» Q prime number (q is a prime factor of p-1) 

• 51,02 e Z p : ordp(0i) = ord p (#2) = q 

• c — g\ Xl g2 X2 mod p, d\ = gi yil g2 yi3 mod p, d<i — gi V21 g2 v ** mod p, h = g\ z mod p, 

• fci, *2, H : positive constant (I0 fcl+ * 2 < g, 10* 3 < g, 10*1+**+** < p) 

• i? : symmetric encipher function 

a ciphertext generation and transmission step of selecting random 
numbers a = ch || a 2 (|oi | = k i? |a 2 | = k 2 ) for key data K (|K| = k3 t where |x| is a 
number of digits of x), calculating: 

m = a\\K 
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selecting a random number r e Zq, calculating: 

ui — g\ r mod p, U2 = 92 r mod p, e = m h r mod p, v = 0i ai c r di otr d2 iCr niod p 

and generating a ciphertext C of transmission data by: 

C = E K {m) 

by using a (symmetric) cryptographic function E and the key data K, and 
transmitting (ui, u 2 , e, v, C) as the ciphertext; and 

a ciphertext reception and decipher step of calculating from the 
received ciphertext and by using the secret key, a'i, a' 2 , K' (|a'i| = k 1y |a' 2 | = k 2 , 
|K'| = k3> which satisfy: 

a^Wa'zWK' = e/ui z modp 

and if the following is satisfied: 

yi a,1 wi Xl+a ' yil+ ^ ,wl w2 a2+a/yi2+iC/V22 = v (mod p) 

where a' = a'i || a' 2l 

executing a decipher process by: 

m = D K ,{C) 

outputting deciphered results, whereas if not satisfied, outputting as the 
decipher results the effect that the received ciphertext is rejected. 

31. A cryptographic communication method according to claim 30, 
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wherein the ciphertext C is generated by: 

C = E K (f(a u a 2 )\\m) 

by using a symmetric cryptographic function E, the key data K and a 
publicized proper function f, it is checked whether the following is satisfied: 

f(a' lf a' 2 ) = [D K ,(C)] k 

where f outputs a value of k bits and [x] k indicates the upper k bits of x, and if 
the check passes, a decipher process is executed by: 

m = [D K ,(C)]- k 

where [x]" k indicates a bit train with the upper k bits of x being removed. 

32. A cryptographic communication method according to claim 28, 
wherein the public-key is generated by a receiver and is made public. 

33. A cryptographic communication method according to claim 28, 
wherein in said ciphertext transmission step, the random numbers cm, 02 
(cheXi, 020X2) and reZq are selected beforehand and the following is 
calculated and stored beforehand: 

ui = pr, u 2 = p 2 r , h\ ^i ai c r cii ar 

34. A cryptographic communication method according to claim 28, 
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wherein in said ciphertext transmission step, the random numbers cm, 02 (|ai| 
= ki, |a 2 | = k 2 ) and r e Zq are selected beforehand and the following is 
calculated and stored beforehand: 

ui — g\ r mod p, u 2 = 92 mod p, h r mod p, <7i ai c r di ar mod p 



35. A cryptographic communication method implemented in a 
computer system comprising: 

a key generation step of generating a secret-key: 

and a public-key: 

• G,G' : finite (multiplicative) group G C G' 

• q : prime number (the order of G) 

• 9l,92 G G 

•c = gi Xl 92 X2 , d = gi**g 2 v *, h = 9l \ 

• 7r : X\ x X2 x M — ► Dom(^) : one-to-one mapping 

(Dom(E) is the domain of the function E) 

• 7T- 1 : Im(7r) — ► X x x X 2 x Af 

• i/ : hash function 

• E : symmetric encipher function 

where the group G is a partial group of the group G\ X1 and X 2 are an infinite 
set of positive integers which satisfy: 

<*i||<*2 < Q (Vai € Xi y Va2 € X 2 ) 

a ciphertext generation and transmission step of selecting random 
numbers aieXi, a 2 eX2, reZq, calculating: 
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ui=gi r , u 2 = p 2 r , v = gi € *d r dr, K = H(h r ) 

where a = ai || a 2 , generating a ciphertext C of transmission data m by 

C = jE?if(7r(ai, a 2 ,m)) 

by using a (symmetric) cryptographic function E; and transmitting (ui, u 2 , v, C) 
as the ciphertext; and 

a ciphertext reception and decipher step of calculating: 

K' = H{u x *) 

by using the secret key, calculating from the received ciphertext, a'i, a' 2 
(where a'i e Xi a' 2 eX 2 ) which satisfy: 

7r(ai,a^m') = D K ,(C) 

if the following is satisfied: 

g l a 'iu 1 Xl + a ' yi u 2 X7 + a ' V2 =v, 

where a' = a'i || a' 2 

outputting m' as the deciphered results, whereas if not satisfied, outputting as 
the decipher results the effect that the received ciphertext is rejected. 

36. A cryptographic communication method implemented in a 
computer system comprising: 

a key generation step of generating a secret-key: 

• Xi,X 2 ,yi,2/2,* e Z g 
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and a public-key: 

• Pj q • prime number (q is a prime factor of p-1) 

• 9U92 € Z p : ordp(si) = ordp(p2) = q 

• c = gi Xl g2 X2 mod p, d = gi Vl g2 V2 mod p t h — g\ z mod p, 

• /ci, fc 2 , A* : positive constant (I0 fcl+fca < q, 10* 3 < g, l0* 1+fc2+ * 3 < p) 

• # : hash function 

• E : symmetric encipher function (the domain of E is all positive integers) 

a ciphertext generation and transmission step of selecting random 
numbers a = cm || a 2 (|ch| = ki, |a 2 | = k 2 , where (|x| is the number of digits of x), 
selecting a random number reZq, calculating: 

u\ = gi r mod p, U2 = 92 r mod p, v = gi Ql c r d? r mod p, K = H(h r mod p) 

transmitting the ciphertext (ui, u 2 , v, C); generating a ciphertext C of 
transmission data m by: 

C = E K (ai\\a 2 \\m) 

by using a (symmetric) cryptographic function, and transmitting (ui, u 2 , v, C) 
as the ciphertext; and 

a ciphertext reception and decipher step of calculating: 

K* = H{m z mod p) 

by using the secret key, calculating from the received ciphertext, a'i, a' 2 (|a'i| 
= ki, |a 2 | = k 2 ) which satisfy: 

a\\\o/ 2 \\m' = D K ,{C) 
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and if the following is satisfied: 

Si a W l+0 ' Vl U2 X3+Q ' Va s ^ (mod p) 

outputting nrY as the deciphered results (where a' = a'i || 0*2), whereas if not 
satisfied, outputting as the decipher results the effect that the received 
ciphertext is rejected. 

37. A cryptographic communication method according to claim 35, 
wherein the public-key is generated by a receiver and is made public. 

38. A cryptographic communication method according to claim 35, 
wherein in said ciphertext transmission step, the random numbers cm, a 2 
(cheXi, 020X2) and r e Zq are selected beforehand and the U1, u 2 , e and v are 
calculated and stored beforehand. 

39. A cryptographic communication method according to claim 36, 
wherein in said ciphertext transmission step, the random numbers cm, a 2 (|ch| 
= ki, |a 2 | = k 2 ), and reZq are selected beforehand and the in, u 2 , e and v are 
calculated and stored beforehand. 

40. A cryptographic communication method implemented in a 
computer system comprising: 

a key generation step of generating a secret-key: 

• sk : (asymmetric cryptography) decipher key 
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and a public-key: 



• G : finite (multiplicative) group 

• q : prime number (the order of G) 

• 9i, 92 e G 

• 7T : X\ x X2 x M — > Dom(E) : ™ e - to ;° n P ™ a PR in g • * >• ^ 

(Dom(E) is the domain of the function E) 

• TT" 1 : Im(7r) — ► Xi x X 2 x M 

• £? p jk(-) : (asymmetric cryptography) encipher function 

where the group G is a partial group of the group G\ X1 and X 2 are an infinite 
set of positive integers which satisfy: 

c*i||<*2 < q (Vai € X\ y Vc*2 € X2) 

where M is a plaintext space; 

a ciphertext generation and transmission step of selecting random 
numbers aieXi, a 2 eX 2 , r eZq, calculating: 

ui = 91, u 2 = 92 \ v = 9i ai c r <F* r 

where a = ai || a 2l generating a ciphertext C of transmission data m by: 

e = E pk (n(ai ) a2,m)) 

by using an (asymmetric) cryptographic function E pk , and transmitting (ui, u 2 , 
e, v) as the ciphertext; and 

a ciphertext reception and decipher step of calculating from the 
received ciphertext and by using the secret key, a'^ a' 2 , m* (aSeXi, a' 2 eX 2 , 
m'eM) which satisfy: 
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ir(ai > oJ t m / ) = U.Jb(c) 



and if the following is satisfied: 

pi ai ^i Xl+Q ' yi u2 X3+Q,y2 =v 

where: 

of«o4llo4 

outputting m' as the deciphered results, whereas if not satisfied, outputting as 
the decipher results the effect that the received ciphertext is rejected. 



41. A cryptographic communication method implemented in a 
computer system comprising: 

a key generation step of generating a secret-key: 

• sk : (asymmetric cryptography) 
decipher key 

and a public-key: 



• P» 9 : prime number (q is a prime factor of p-1) 

• g Xt g 2 € Z p : ordpfoi) = ord p (^ 2 ) = q 

• c = g\ Xl g2 X2 mod p, d = gi yi g2 V2 mod p, 

• ki,fc 2 : positive constant (10* 1+ * 2 < g) 

• iSpjt(0 : (asymmetric cryptography) encipher function 

(the domain is all positive integers) 

a ciphertext generation and transmission step of selecting random 
numbers a = ai || a 2 (|ai| = ki, |a 2 | = k 2 , where |x| is the number of digits of x), 
selecting a random number r e Zq, calculating: 



70 



ui = gi r mod p, U2 = 92 r mod p, v = 0i Qx c r ef* r mod p 

generating a ciphertext C of transmission data m (positive integer) by: 

e = £p fc (ai| | a 2 1 |m) 

by using the secret key, and transmitting (ui, u 2 , e, v) as the ciphertext; and 

a ciphertext reception and decipher step of calculating from the 
received ciphertext and by using the secret key, a'i, a' 2 , m' (|a'i| = k^ |a' 2 | = k 2 , 
m' is a positive integer) which satisfy: 

ail|ai||m'=D afc (e) 
and if the following is satisfied: 

gi<ui xl+afyi U2 X2 ^ <xfy2 s v (mod p), 

where: 

a' = ai||ai 

outputting m' as the deciphered results, whereas if not satisfied, outputting as 
the decipher results the effect that the received ciphertext is rejected. 

42. A cryptographic communication method according to claim 40, 
wherein the public-key is generated by a receiver and is made public. 

43. A cryptographic communication method according to claim 40, 
wherein in said ciphertext transmission step, the random numbers a 2 
(QicXt, a 2e X 2 ) and r e Zq are selected beforehand and the ui, u 2 and v are 
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calculated and stored beforehand. 

44. A cryptographic communication method according to claim 41, 
wherein in said ciphertext transmission step, the random numbers ch, a 2 (|a n | 
= ki, |a^| = k 2 ), and reZq are selected beforehand and the Ui, u 2 and v are 
calculated and stored beforehand. 
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EVIDENCE APPENDIX 

There is no evidence relied upon in this Appeal. 
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RELATED PROCEEDINGS APPENDIX 

There are no related proceedings. 
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To the extent necessary, applicants petition for an extension of time 
under 37 CFR §1.136. Please charge any shortage in the fees due in 
connection with the filing of this paper, including extension of time fees, to 
Deposit Account No. 50-1417 (Case No. 500.41092X00) and please credit 
any excess fees to such Deposit Account. 
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